Computer Security Ch 7 - Exam III

an attempt to compromise availability by hindering or blocking completely the provision of some service - attempts to exhaust some critical resource associated with the service

packets whose structure triggers a bug in the system's network handling software, causing it to crash

a large number of large, costly queries constructed to overload the server

a flooding attack on an organization aimed to overwhelm the capacity of the network connection to the target organization

the use of forged source addresses in a DoS attack

the ICMP (Internet Control Message Protocol) echo response packets that are generated in response to a ping flood using randomly spoofed source addresses

attacks the ability of a network server to respond to TCP connection requests by overflowing the tables used to manage such connections

types of flooding attacks

the use of multiple systems to generate attacks overloading a system

attacks that attempt to take advantage of the disproportionally large resource consumption at a server

two types of protocols that can be used for application-based bandwidth attacks

an attack that bombards Web servers with HTTP requests - typically a DDoS attack with HTTP requests coming from many different bots

an HTTP-based attack that uses multiple threads to support multiple requests to the same server application - utilizes legitimate HTTP traffic, and does not rely on using special "bad" HTTP requests that exploit bugs in specific HTTP servers

the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system, when the intermediary responds, the response is sent to the target - relfects the attack off the intermediary

a variant of reflector attacks - involves sending a packet with a spoofed source address for the target system to intermediaries - they can differ in generating multiple response packets for each original packet sent out

four lines of defense against DDoS attacks

the system's TCP/IP network code can be modified to selectively drop an entry for an incomplete connection from the TCP connections table when it overflows, allowing a new connection attempt to proceed

the first step upon detection of a DoS attack

three targets that attackers usually attack

type of flood that affects VoIP - attacker can flood with numerous INVITE requests with spoofed IP addresses